iOWN Token security audit report

ETH_iOWNToken_report.md

iOWN Token security audit report

Summary

This is the report from a security audit performed on iOWN Token by gorbunovperm.

iOWN Token is an ERC20 token for iOWN project based on Openzeppelin. It is intended work as a standard ERC-20 Utility token, to be traded on exchanges and used for payments on iOWN Platform when it is released.

The contract has minor functionalities added to satisfy requirements: like releasing token as ODR (on demand release balance: ODR will be released later on).

https://www.iowngroup.com/

In scope

Commit hash: c559f9ee36f1da2b9fd520a0200ee43b95ac848c

1. IownToken.sol
2. CappedBurnableToken.sol
3. Migrations.sol
4. TokenTreasury.sol
5. TransfererRole.sol
6. UpgradeAgent.sol
7. UpgradeableToken.sol

Findings

In total, 6 issues were reported including:

• 0 critical severity issue.

• 0 high severity issue.

• 3 medium severity issues.

• 3 low severity issues.

• 0 minor observations.

Security issues

1. Known vulnerabilities of ERC-20 token

Severity: low

Description

• It is possible to double withdrawal attack. More details here

• Lack of transaction handling mechanism issue. WARNING! This is a very common issue and it already caused millions of dollars losses for lots of token users! More details here

Recommendation

Add into a function transfer(address _to, ... ) following code:

require( _to != address(this) );

2. Owner's Privileges

Severity: medium

Code snippet

• ERC20Pausable
• pause transfer
• pause transferFrom

Description

The contract owner allowed to pause functions of contract (transfer, transferFrom). And the same with freezing mechanism.

3. The upgrading is not secure process for investors

Severity: medium

Code snippet

• upgrade

Description

The owners can implement any logic in the new contract. And even if the new contract will be audited, at any time possible to change the address of the new contract again to unaudited and insecure.

4. Not possible to use the contract upgrade

Severity: medium

Code snippet

• UpgradeableToken.sol

Description

_upgradeReady is false by default and there is no way to change this variable. In this case, it is not possible to use the contract upgrade.

5. Two identical checks

Severity: low

Code snippet

• constructor of TokenTreasury

Description

There are two same checks

    require(tokenAddress != address(0), "Invalid token owner address provided");
    require(tokenAddress != address(0), "Invalid token address provided");

But no check of owner address.

6. Upgrade should be possible only when the token is released

Severity: low

Code snippet

• cap and totalSupply

Description

Upgrade should be possible only when the token is released. Otherwise, the totalSupply of the old token and the new token may not match. Because validation only occurs for cap().

Conclusion

There are some vulnerabilities were discovered in these contracts.